This invention relates generally to data processing systems in a network environment. More particularly, it relates to a method and system for administrating passwords on remote machines which use different operating and security systems.
It is becoming increasingly prevalent to couple a plurality of data processing systems in an interconnected computing environment such as a Local Area Network (LAN) or Wide Area Network (WAN). These networks are becoming increasingly complicated with several different LAN networks passing messages according to different protocols coupled together within processing systems for multiple vendors in the network. It is also becoming popular to couple a mainframe type data processing system to the network through a gateway server.
With the complexity and increasing size of such networks, it is also recognized that data within the system and transmitted between the various data processing systems must be protected against unauthorized disclosure, destruction and modification. The process by which a system knows that a potential user is authorized to obtain access to a system is known as "Authentication". Typically, a userid and a password are used in the authentication process to prove the legitimacy of the user attempting to logon. After authentication on all the systems to which the user is allowed access, information can be passed between the mainframe system and the personal computers on the network. Most security systems require that a password be chagned after a period of time to reduce the likelihood of unauthorized access.
Unfortunately, the security systems used for the authentication process generally differ on the two types of systems. For example, a personal computer running on the OS/2.TM. operating system with Extended Services.TM., both manufactured by the IBM Corporation uses the User Profile Management (UPM) security system and IBM 370 mainframe systems may use the Resource Access Control Facility (RACF) security system. Each security system maintains its own plurality of encrypted user logon profiles and has its own authentication process. The user password on the gateway machine on the network and UPM must also be on the mainframe and RACF. The user id and password must be updated on all systems or the user will not be able to access all the data in the network. Further, the process by which a new password is entered and the criteria for a valid password vary between security systems. Currently, it is left to the user to ensure that a password changed at the local node is also changed at all remote nodes which may include a mainframe. The presence of the two security systems complicates matters, it would be highly desirable to coordinate the two security systems.
The prior art has failed to provide such a coordination means.